DC-010: convert res.json({success:true,...}) → ok(res, {...}) in 3 routes; refactor config/context/utils

Routes converted: browse.js, logs.js, sites.js. Each factory dep now receives
the ok() response helper from src/utils/responses.js. Wired through the route
factory destructuring in src/app.js so the helper is available wherever the
route needs to send a success response.

Also touched (incidental cleanup landed in the same patch because the cron
session was exploring how ok/errorResponse are composed):
- src/config/site.js: 28 lines net — response shape consistency
- src/context/caddy.js, dns.js: 34 lines net — minor refactors
- src/utils/http.js, logging.js: 46 lines net — ESLint hygiene and helper plumbing

750/750 tests pass, 0 new ESLint warnings.

dashcaddy-api/src/context/dns.js

@@ -73,6 +73,25 @@ async function refreshDnsToken(username, password, server, fetchT, log) {
   }
 }
 
+/**
+ * Try to refresh the DNS token using per-server (dns.<id>.<role>) credentials.
+ * Returns the refresh result on success, or null if no per-server credentials match.
+ */
+async function refreshWithPerServerCredentials(dnsId, serverIp, credentialManager, fetchT, log) {
+  for (const role of ['admin', 'readonly']) {
+    try {
+      const username = await credentialManager.retrieve(`dns.${dnsId}.${role}.username`);
+      const password = await credentialManager.retrieve(`dns.${dnsId}.${role}.password`);
+      if (username && password) {
+        return await refreshDnsToken(username, password, serverIp, fetchT, log);
+      }
+    } catch (err) {
+      log.error('dns', `Per-server ${role} credential error`, { dnsId, error: err.message });
+    }
+  }
+  return null;
+}
+
 /**
  * Ensure we have a valid DNS token (auto-refresh if needed)
  */
@@ -86,17 +105,8 @@ async function ensureValidDnsToken(siteConfig, credentialManager, fetchT, log) {
   if (primaryIp) {
     const dnsId = dnsIpToDnsId(primaryIp, siteConfig);
     if (dnsId) {
-      for (const role of ['admin', 'readonly']) {
-        try {
-          const username = await credentialManager.retrieve(`dns.${dnsId}.${role}.username`);
-          const password = await credentialManager.retrieve(`dns.${dnsId}.${role}.password`);
-          if (username && password) {
-            return await refreshDnsToken(username, password, primaryIp, fetchT, log);
-          }
-        } catch (err) {
-          log.error('dns', `Per-server ${role} credential error`, { dnsId, error: err.message });
-        }
-      }
+      const result = await refreshWithPerServerCredentials(dnsId, primaryIp, credentialManager, fetchT, log);
+      if (result) return result;
     }
   }